From 28c9e156937613d81633aadbbf59e368f857f779 Mon Sep 17 00:00:00 2001
From: Marco Constantino <maconstantino@gmail.com>
Date: Sat, 5 Sep 2026 01:27:18 +0200
Subject: [PATCH] Guard against two DoS crashes: parser recursion depth and
 integer div/mod by zero

Add a recursion depth cap in Parser::parseExpression. Deeply-nested expressions
previously recursed through the expression-precedence chain without bound and
exhausted the stack (SIGSEGV at parse time). jinja2 guards recursion here.

Guard integer division and modulo against a zero divisor at all sites (the
BinaryOpExpr evaluation switch and the Value operators). Previously {{ 1/0 }},
{{ 5//0 }} or {{ x%0 }} crashed with SIGFPE at render time.

Both throw std::runtime_error, consistent with existing error handling. Verified
against 239 real chat templates (unchanged) and normal arithmetic
(1+2*3=7, 10%3=1, 8/2=4). Found via coverage-guided fuzzing.
---
 include/minja/minja.hpp | 24 ++++++++++++++++++------
 1 file changed, 18 insertions(+), 6 deletions(-)

diff --git a/include/minja/minja.hpp b/include/minja/minja.hpp
index 5ed0556..72098d0 100644
--- a/include/minja/minja.hpp
+++ b/include/minja/minja.hpp
@@ -499,13 +499,17 @@ class Value : public std::enable_shared_from_this<Value> {
         return get<double>() * rhs.get<double>();
   }
   Value operator/(const Value& rhs) const {
-      if (is_number_integer() && rhs.is_number_integer())
-        return get<int64_t>() / rhs.get<int64_t>();
-      else
+      if (is_number_integer() && rhs.is_number_integer()) {
+        auto d = rhs.get<int64_t>();
+        if (d == 0) throw std::runtime_error("integer division by zero");
+        return get<int64_t>() / d;
+      } else
         return get<double>() / rhs.get<double>();
   }
   Value operator%(const Value& rhs) const {
-    return get<int64_t>() % rhs.get<int64_t>();
+    auto d = rhs.get<int64_t>();
+    if (d == 0) throw std::runtime_error("modulo by zero");
+    return get<int64_t>() % d;
   }
 };
 
@@ -1371,8 +1375,8 @@ class BinaryOpExpr : public Expression {
               case Op::Mul:       return l * r;
               case Op::Div:       return l / r;
               case Op::MulMul:    return std::pow(l.get<double>(), r.get<double>());
-              case Op::DivDiv:    return l.get<int64_t>() / r.get<int64_t>();
-              case Op::Mod:       return l.get<int64_t>() % r.get<int64_t>();
+              case Op::DivDiv:    { auto d = r.get<int64_t>(); if (d == 0) throw std::runtime_error("integer division by zero"); return l.get<int64_t>() / d; }
+              case Op::Mod:       { auto d = r.get<int64_t>(); if (d == 0) throw std::runtime_error("modulo by zero"); return l.get<int64_t>() % d; }
               case Op::Eq:        return l == r;
               case Op::Ne:        return l != r;
               case Op::Lt:        return l < r;
@@ -1705,6 +1709,7 @@ class Parser {
     std::shared_ptr<std::string> template_str;
     CharIterator start, end, it;
     Options options;
+    int expr_depth = 0;
 
     Parser(const std::shared_ptr<std::string>& template_str, const Options & options) : template_str(template_str), options(options) {
       if (!template_str) throw std::runtime_error("Template string is null");
@@ -1882,6 +1887,13 @@ class Parser {
     }
 
     std::shared_ptr<Expression> parseExpression(bool allow_if_expr = true) {
+        struct DepthGuard {
+            int & d;
+            explicit DepthGuard(int & d) : d(d) {
+                if (++d > 1000) throw std::runtime_error("expression nesting too deep");
+            }
+            ~DepthGuard() { --d; }
+        } depth_guard(expr_depth);
         auto left = parseLogicalOr();
         if (it == end) return left;